DEVNET-1009 Cisco Intercloud Fabric for Business (ICFB), Helping Enterprises Move to Hybrid Cloud!
•Download as PPTX, PDF•
0 likes•1,451 views
Several enterprises find themselves wondering how to use public cloud resources while maintaining security, consistent network policies and avoid cloud vendor lock-in. This session will introduce Cisco Intercloud Fabric (ICF) and how it provides a single pane of glass to manage hybrid cloud infrastructure. By extending enterprise network onto public cloud, Cisco ICF enables customers to have the same level of security on public cloud as is present in their private cloud.
Recommended
More Related Content
What's hot
What's hot (20)
Similar to DEVNET-1009 Cisco Intercloud Fabric for Business (ICFB), Helping Enterprises Move to Hybrid Cloud!
Similar to DEVNET-1009 Cisco Intercloud Fabric for Business (ICFB), Helping Enterprises Move to Hybrid Cloud! (20)
More from Cisco DevNet
More from Cisco DevNet (20)
Recently uploaded
Recently uploaded (20)
DEVNET-1009 Cisco Intercloud Fabric for Business (ICFB), Helping Enterprises Move to Hybrid Cloud!
- 2. Cisco Intercloud Fabric for Business, helping enterprises move to hybrid cloud Chhavi Nijhawan Technical Marketing Engineer, Cloud Network Services Group, Cisco Systems DEVNET-1009
- 3. • Why Hybrid IaaS? • Cisco Intercloud Fabric What and Why Architecture, Services Newly introduced features (release 2.2.1) Deployment Considerations References and related sessions. • Q&A Agenda
- 4. DC/Private Clouds Provider Clouds Why Hybrid IaaS? Striking the Perfect Balance Fixed workloads Elastic workloads Choice to build / rent across providers Workload portability Consistent security Economics Speed Scale Data Sovereignty Control Hybrid Security
- 5. Reality of Hybrid Cloud and Key Challenges • Require App Re-Configuration • Slow and Manual Process of Discovering Infrastructure Dependencies • No Visibility or Control Slow and Complex • Inconsistent Cloud Architectures • Fragmented Solutions Solving Networking and Security Challenges • Different Management Tools Siloed Infrastructure • Unsecure Connection • Limited Workload Protection Loss of Security
- 6. DC/Private Cloud End User and IT Admin Portals Secure Fabric Extender Network, Compute, and Storage vSphere Hyper-V KVM Xen* Intercloud Fabric for Business EC2 APIs Azure APIs Provider Clouds Intercloud Fabric for Providers Cisco Powered Services and Cloud Providers Cisco Intercloud Fabric: Solution Overview * Available in subsequent releases
- 8. Intercloud Fabric Structure Cisco Intercloud Fabric Architecture is Modularized to Achieve the Elasticity Needed to Support Evolving Cloud Environments ICF Extended Services + External Partners (storage, load balancing, etc.) ICF Core Services Security Management and Visibility AutomationVM Portability ICF Core Infrastructure ICFD PNSC ICFPP Secure Communications Private Cloud: Enterprise Public Cloud: Provider Networking
- 9. Intercloud Fabric Secure Extender (Secure Network Extension) DC/Private Cloud Provider Cloud Cisco Intercloud Fabric Architectural Details Intercloud Switch VM Manager Intercloud Fabric Services Intercloud Extender Intercloud Fabric Director End User and IT Admin Portal Workload and Fabric Management IT AdminsEnd Users VM VM VM VM Intercloud Fabric for Business Secure Layer 2 Extension to Cloud Extend VLAN/VXLAN with DTLS/TLS/HTTPS Tunnel Flexible Application Reachability Enterprise IP Address or Provider IP Address Network & Security Services Inter-VM firewalling and routing
- 10. Intercloud Fabric GUI -- admin
- 11. Intercloud Fabric GUI -- user
- 12. Intercloud Fabric GUI -- user
- 14. ICF Core Services ICF Core Services Fundamental Service Functions and Capabilities Integrated Natively to ICF and its Operation Security Management and Visibility Automation and APIs VM to VM and App-to-App security controls Private and hybrid cloud monitoring capabilities VM lifecycle capabilities, automated operations and Programmatic APIs VM Portability VM format conversion and mobility Networking Switching, routing and other advanced network-based capabilities
- 15. Core Services: VM Portability VM portability is the process or converting an existing image from the source cloud format to the destination cloud format, and placing it on the destination cloud with its associated policy Value: VMs can be placed on any cloud independently from the origin cloud and hypervisor flavor, yet conserving the application related policies Key VM Portability Functions: Format Conversion Policy Portability and Control Driver (Agent) Application Instantiation
- 16. Intercloud Fabric Services VM is powered up on public cloud and management continues through Intercloud Fabric Director4 VM Portability: Migration Across Hybrid Cloud Intercloud Fabric Secure Extender DC/Private Cloud Provider Cloud Intercloud Switch Intercloud Extender IT AdminsEnd Users VM VM VM Image is converted to public cloud format (e.g., AMI) and migrated to public cloud 3 End user/admin triggers VM migration to cloud 1 VM is shut down and Intercloud Fabric driver added2 VM Manager Intercloud Fabric Director Intercloud Fabric for Business
- 17. ICF VM Image Conversion Install Driver and Normalize to Raw Convert Normalized Image to Provider Format Provider Image Storage Image Install Driver and Keys Import Source Image ISO RAW VMDK OVA VM Manager Convert Raw Image to Provider Format Converted Raw Image RAW Upload VM Image to Datastore Private Cloud Public Cloud Converted Image AMI VHD VMDK OVA Uninstall Driver and Normalize to Private Format Convert Cloud Image to RAW Format Remove Driver and Keys Download Source Image ISO RAW VMDK OVA VM Manager Convert Image to RAW Format Converted Raw Image RAW Download VM Image from Datastore Downloaded Image AMI VHD VMDK OVA Provider Image Storage Image
- 18. Intercloud Fabric Features – Security • Secure Tunnels • Site-to-Site tunnel - Enterprise to Cloud Provider • UDP, TCP, HTTPS • Multiple encryption, hash, and rekey choices • Access tunnel – intra VM communication in the provider Cloud • UDP • Multiple encryption, hash and rekey choices • Cloud Security Groups • MAC Address Filtering • Intercloud Fabric Firewall http://www.cisco.com/c/en/us/products/collateral/cloud-systems-management/intercloud-fabric/white-paper-c11-734535.html Encryption algorithm – AES-128-GCM, AES-128-CBC, AES-256-GCM (Suite B), AES-256-CBC Hashing algorithm – SHA-1, SHA-256, SHA-384 Private CloudCisco Intercloud Fabric Security Features: Technical Overview White Paper ICX Public Cloud ICS VM VM Private
- 19. Intercloud Fabric Secure Extender (Secure Network Extension) DC/Private Cloud Provider Cloud Intercloud Switch Intercloud Fabric Director Intercloud Fabric for Business Intercloud Extender IT Admins Intercloud Fabric Intercloud Fabric VSG: Protects VMs in Provider Cloud Test VM Test VM Enterprise VSG: Protects VMs in Private Cloud Single Security Policy for Private and Provider Clouds Web VM Core Services: Firewalling/Zoning
- 20. Intercloud Fabric for Business Intercloud Fabric Director Enterprise VPN Access to Public cloud VMs Core Services: Routing Across Hybrid Cloud Direct access to public cloud VMs through NAT Intercloud Fabric Secure Extender DC/Private Cloud Provider Cloud Intercloud Extender VM VM VM VM VLAN App 19.2.168.x.x Default Gateway for VLAN A &B VLAN Web VMVM VMVM Provider Gateway 10.x..x.x 54.x..x.x VLAN A Intercloud Fabric CSR Inter-VLAN communication through ICF Routing VLAN B 192.168.x.x Remote/ Branch Office ISR VPN VPN Mobile Worker Mobile Worker Intercloud Switch
- 21. Newly released features (release 2.2.1)
- 22. New Features Security Automation and APIs Networking Platform Features Intercloud Fabric Router (Integrated) support on Azure Cloud Security Groups, Intercloud Fabric Firewall on Azure and Cisco Intercloud Services Seamless Upgrade support, AWS VPC support, limited support for Hyper- V and KVM/Openstack platforms Management and Visibility ERSPAN, Netflow for Traffic Visibility, Cloud VM on-boarding into ICF management End User Single Pane of Glass through Integration with PSC version 11.0 Storage Support for Multiple Disks within Guest VMs
- 23. • User could have created VM directly on provider cloud before or after installing ICF • These VMs are not secured by the IcfCloud bubble and not layer 2 extended from enterprise cloud • User wants to bring it into the secure IcfCloud bubble so that it can be managed from single place and make use of enterprise IP to manage them securely – this is the shadow IT use case The onboarding feature is about bringing these non ICF VM into ICF
- 24. Tenant Virtual Network 10.1.1.0/24 Gateway 10.1.1.1 Tenant VM 1 Guest 10.1.1.3 Tenant ICS Guest 10.1.1.2 Tenant Virtual Router Public IP 65.37.141.11 65.37.141.36 Internet cVSM VMVM ICX Secure Access Tunnels Intercloud Fabric Director 192.168.1.2192.168.1.1 192.168.1.3 192.168.1.4 Enterprise Subnet Enterprise Subnet Interfaces ICFD Admin SP Public Cloud Datacenter Enterprise Private Cloud Datacenter Tenant VM 2 Guest 10.1.1.4 Secure Network Extender icfLink icfCloud Tenant VM 3 Guest 10.1.1.5 Step 1: Download ICF Onboarding package Step 2: Install ICF Onboarding package Step 3: Onboard VM from provider Tenant VM 3 Guest 10.1.1.5 192.168.1.5
- 26. Supported enterprise hypervisors: Vmware vSphere (5.1,5.5) OpenStack KVM (Icehouse) Microsoft System Center Virtual Machine Manager(SCVMM 2012 R2) Providers: Amazon Web Services, Azure, Cisco Integrated Services • OS Versions: • RHEL 6.0 - 6.5: 64-bit versions • CentOS 6.2 - 6.5: 64-bit versions • Windows 2008 R2 SP1 • Windows 2012 • Windows 2012 R2 • SUSE Linux 11 SP2 and SP3 Cisco Intercloud Fabric Support Matrix
- 27. Key Benefits of Intercloud Fabric
- 28. • Consistent architecture across heterogeneous environments – any hypervisor to any cloud • Secure communications between private and public cloud and between VMs in the public cloud • Layer 2 extension provides seamless access to enterprise services from the public cloud - no change to applications • Single point of cloud connection management – eliminate Shadow IT • Workload portability - Image conversion and VM migration • RBAC integrated with LDAP – Use existing security practices to protect access to cloud workloads
- 30. 3434 Related Sessions @CiscoLive San Diego 2015. Session ID Title PSOCLD-1001 Hybrid Cloud with Intercloud Fabric PSODCT-1009 Hybrid Clouds: Integrating the Enterprise Data Center and the Public Cloud BRKCLD-2003 Building Hybrid Cloud Applications with Intercloud Fabric TECCLD-3001 Intercloud Fabric Technical Deepdive BRKCLD-1828 Designing Hybrid Cloud operations with ServiceGrid and Intercloud Fabric DEVNET-1128 Cisco Intercloud Fabric NB Api's for Business & Providers DEVNET-2009 Intercloud Fabric REST APIs for Providers DEVNET-1120 Intercloud Fabric - AWS and Azure Account Setup and Utilization DEVNET-1009 Cisco Intercloud Fabric for Business (ICFB), Helping Enterprises Move to Hybrid Cloud! DEVNET-1136 Cisco ONE Enterprise Cloud Suite for Infrastructure Management DEVNET-1008 Private or Public or Hybrid ? Which Cloud Should I choose?
- 31. 3535 Related Sessions @CiscoLive San Diego 2015. Session ID Title TECDCT-2750 Unleash the Power of Cisco ONE Enterprise Cloud Suite for Infrastructure Management and Automation BRKDCT-2522 Cisco Enterprise Cloud Suite BRKCLD-1004 End-to-end Cloud Management: A holistic approach for developing and managing the platform and service offerings that transform IT PSOCLD-1002 Cisco Cloud Services - A product overview BRKCLD1002 Cloud Onboarding BRKCLD1003 A Practical Introduction to DevOps Practices and Tools BRKCLD2001 Building scalable and highly available enterprise applications on Cisco Cloud Services BRKCLD2002 Cisco Cloud Services - Under the Hood LTRVIR-2999 Using the Nexus 1000V to Deploy Virtual Application Container Services & OpenStack Introduction
- 32. Intercloud Fabric Resources • Hands On • 60 Day License for 10 VMs included in Intercloud Fabric • Install and run with your Amazon AWS or Microsoft Azure provider accounts • DevNet • Test out the ICF APIs in DevNet sandbox • http://develper.cisco.com/cloud • Cisco dCloud • Self-Paced lab covering all aspects of Intercloud Fabric • http://dcloud.cisco.com • Official Site • www.cisco.com/go/intercloudfabric • Documentation • http://www.cisco.com/c/en/us/products/cloud-systems-management/intercloud-fabric/literature.htm ICF release notes http://www.cisco.com/c/en/us/td/docs/cloud-systems-management/cisco-intercloud-fabric/cisco-intercloud-fabric-for-business/2-2- 1/release-notes/b_Cisco_Intercloud_Fabric_Release_Notes_Release_2_2_1.html
- 33. Thank you
Editor's Notes
- Hello everyone. Welcome to this session on “Cisco Intercloud Fabric”, helping enterprises move to hybrid cloud. Let me introduce myself:
- Before we get started, How many use public cloud like AWS (amazon web services)? Azure? How many in this room know what is CIF? So a fairly good number. My aim for this session is that when you get out this room, you are able to tell what is ICF. What are its advantages and services/features. This is a fairly short session, 30 minutes. So I don’t think I can cover the details of all the services or hands on but atleast I can give a view of what is ICF.
- Why do people use public cloud IaaS? Public clouds tend to be cheaper since they are using shared infrastructure and more suited for applications whose information is not private/sensitive. Private cloud are on the other hand look to be more expensive (atleast short term), but offer higher level security, data sovereignity, higher slas. The tradeoff is stricktly a buisness decision by cloud buyers, but most companies use public cloud today for test results, HR, email and CRM. In terms of private cloud usage, mission critical, highly sensitive, heavy data usage applications aka big data applications are example of applications that companies use for public cloud. Private cloud is also used by enterprises as a step towards providing their employees cloud in a controlled environment. Hybrid cloud provides the best of both worlds. Typical hybrid cloud starts with runnign applications/hosting databases in private cloud and then burst onto public cloud when load is heavy or usage is high. Most companies use public cloud to get extra on-demand capacity which is called cloud bursting. That’s a common practice for hybrid application. You can even leverage both public and private by running some applications in private and some in private.
- Is my data secure when I use public cloud. Security firewall policies, network policies etc are now different from private and they are different for different cloud providers. Now I need to learn public cloud providers portal to be able to deploy instances on public cloud, learn how to create security polies etc. there. I have to re-configure my apps e.g. ip address are differen in private and public. Lack of visibility and I have to re-do this whole process if I decide to use another/multiple cloud provider
- ICF comes in 2 flavors ICFB, ICFP. ICFP is used by service providres to become part of ICF. ICF provdies a software solution to manage hybrid cloud infrastructure. Complete software solution Deployed in private cloud Single pane of glass to burst onto different cloud providers. Different portals for different users (so RBAC) Secure extention on public cloud. End to end security No vendor lockin Choice of hypervisor in private cloud
- ICF architecture can be structured into 3 tier ICF core infrastructure ICF core services These 2 are present in any iCF deployement and are part of our core design. 3. Extended services which we are still adding on. It’s a developing product and we are consicdering adding load balancing, data at rest encryption services with 3rd parties. All that consists of the extended services.
- ICF is deployed as an OVA in private cloud. ICF solutions consists of Intercloud Fabric Director – which provides the GUI/web based interface to manage your hybrid infrastructure. Intercloud fabric director is Single pane for glass i.e. it gives you a way to deploy cloud to multiple cloud providers and manage. providing administrator and end-user self-service portal through a web-based interface On the private cloud side, it talks to the vm manager e.g. if you have vmware as the hypervisor then vm manager is vcenter, openstack –openstack controller node etc and displays what vms you have running in private cloud. You can deploy a firewall (vsg) via intercloud fabric on private side and define firewall security policies. Intercloud Fabric Secure Extender Intercloud Extender – Virtual Machine in enterprise data center to provide secure connectivity to the Intercloud Switch in provider cloud Intercloud Switch – Virtual Machine in provider data center, has secure connectivity to the Intercloud Extender in enterprise cloud and secure connectivity to the Virtual Machines in the provider cloud. Intercloud Fabric Services – Virtual zone-based firewall and virtual router services running in the provider cloud Intercloud Fabric Provider Platform – Only required for Provider Edition to enable service providers without public APIs to integrate with Intercloud Fabric
- Logged in as admin onto GUI and I created two secure links 1. AWS, 2. Azure (see ICX, ICS)
- VM portability is one of our core service We enable customers to migrate VMs from private to public cloud and bring them back i.e. migrate them from private to public. ICF provides a way to manage hybrid cloud infrastruce with choice of different public cloud providers. With choice comes complexity. Different cloud providers have different VM image types. AWS has AMI, Azure has VHD, so on so forth…
- VMware has solution for customers moving workloads from traditional data centers toVMware cloud. Ic enables these same customers to eliminate application change requirements when targeting AWS, or VMware-based or other non-VMware-based workloads and applications for the cloud."
- We provide multiple layers of security on public cloud. Security features include Security site to site tunnel between private and public cloud UDP, TCP, HTTPs, multiple encryption and hashing algorithms. We take care of the Key generation and distrubition 2. Ever cloud Vm that gets deployed/migrated to public cloud creates a secured DTLS based tunnel with ICS. This makes all intra Vm communications on public cloud secure and encrypted. You can selecte multiple encryption and hashing algortihms. There are re-key choices.
- Secure enterprise provider data communications Encrypted layer 2 extension Multiple levels of encryption Enterprise templates work seamlessly in provider cloud Standardized service consumption Cloud Agnostic Routing Service Firewall Service Storage Service Workload mobility Bi-directional workload mobility with built-in image conversion services